<html>
<head><meta charset="utf-8"><title>heap corruption/double free/invalid pointer free bug · t-compiler/rust-analyzer · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/index.html">t-compiler/rust-analyzer</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html">heap corruption/double free/invalid pointer free bug</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="185369450"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/185369450" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#185369450">(Jan 11 2020 at 02:22)</a>:</h4>
<p>I know that probably wont be of much help but I just got such an abort message with ra:</p>
<div class="codehilite"><pre><span></span>free(): invalid next size (fast)
</pre></div>


<p>It happened after I removed a dependency from my Cargo.toml</p>
<p>It worries me because such shouldnt happen in Rust, is rust-analyzer using unsafe code in a way it could cause such a bug or not?</p>



<a name="185381569"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/185381569" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Emil Lauridsen <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#185381569">(Jan 11 2020 at 09:04)</a>:</h4>
<p>We do have some unsafe trickery with regards to how we store syntax trees in Rowan using ThinDST, my initial concern would be that. I'll a attempt to run with a sanitizer and reproduce later. Thanks for the tip</p>



<a name="185386542"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/185386542" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Emil Lauridsen <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#185386542">(Jan 11 2020 at 11:40)</a>:</h4>
<p>I've been unable to reproduce so far, but if you can boil it down to a reproducible test case I'll gladly investigate further.</p>



<a name="185393059"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/185393059" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#185393059">(Jan 11 2020 at 15:01)</a>:</h4>
<p>I've been unable to reproduce as well. It seems that the scenario requires a very specific chain of actions for this to trigger.</p>
<p>Do you plan on getting rid of unsafe here? I think this could be very much exploitable.</p>



<a name="185393614"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/185393614" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> matklad <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#185393614">(Jan 11 2020 at 15:17)</a>:</h4>
<p>There's only a single place where rust-analyzer fundamentally relies on unsafe -- in the syntax tree implementation. </p>
<p>It is very fancy data structure which requires unsafe to be efficient, and it indeed has quite a few of non-trivail <code>unsafe</code> block.</p>
<p>I believe that the (safe) public interface is sound and implementable, but:</p>
<ul>
<li>I am not sure if the implementation is bug free</li>
<li>I know a couple of bits of questionable soundness in the implementation (which deal with current lang limitations around DSTs)</li>
</ul>



<a name="185393822"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/185393822" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> matklad <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#185393822">(Jan 11 2020 at 15:23)</a>:</h4>
<p>In general, rust-analyzer assume non-hostile environment, security-wise. That is, UB is UB and must be fixed, but we generally don't try extremely hard to guarantee the absence of UB (or other security issues).</p>



<a name="186493499"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186493499" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186493499">(Jan 24 2020 at 13:54)</a>:</h4>
<p><span class="user-mention" data-user-id="133169">@matklad</span> well third party crates are effectively data from random people on the Internet. Some times I review code and like to have IDE tools to do it, I don't want this code to compromise my machine.</p>



<a name="186499109"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186499109" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Emil Lauridsen <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186499109">(Jan 24 2020 at 15:01)</a>:</h4>
<p><span class="user-mention" data-user-id="214522">@Leo Le Bouter</span> I can assure you it won't compromise your machine any more than a <code>cargo check</code> will.<br>
If your threat model involves RCE from reviewing untrusted crates you should probably be running your entire setup isolated from anything important, preferably on an airgapped machine, but at least in a VM</p>



<a name="186499473"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186499473" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> std::Veetaha <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186499473">(Jan 24 2020 at 15:05)</a>:</h4>
<p><span class="user-mention" data-user-id="212936">@Emil Lauridsen</span> , can you please elaborate on how  and which sanitizer you run? If such a problem exists in <code>rust-analyzer</code> I guess we would need to integrate sanitizing more closely (and add some comments on that to our dev docs)</p>



<a name="186499845"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186499845" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Emil Lauridsen <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186499845">(Jan 24 2020 at 15:08)</a>:</h4>
<p>(Note: this is not me saying the issue isn't important, just that it probably isn't security critical, and not really actionable until somebody has a stacktrace or reproducible example)</p>



<a name="186499887"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186499887" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Emil Lauridsen <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186499887">(Jan 24 2020 at 15:09)</a>:</h4>
<p><span class="user-mention" data-user-id="258149">@std::Veetaha</span> I tried a run with valgrind but no luck replicating so far</p>



<a name="186500167"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186500167" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> std::Veetaha <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186500167">(Jan 24 2020 at 15:11)</a>:</h4>
<p>Okay, I think I'll create an issue for sanitizing memory-safety issues in <code>rust-analyzer</code>. I know this is not the highest priority right now, but I guess I'll try to tackle that myself once I have time for that.</p>



<a name="186500362"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186500362" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> std::Veetaha <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186500362">(Jan 24 2020 at 15:13)</a>:</h4>
<p>By the way, speaking about soundness... <code>rowan</code> red-green tree seems to have circular references under the good. I didn't get so much into the details of its unsafe code, but my first concern would arise about <code>&amp;mut</code> references aliasing (though it shouldn't cause ivalid <code>free()</code> in theory)</p>



<a name="186570029"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186570029" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> std::Veetaha <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186570029">(Jan 25 2020 at 11:41)</a>:</h4>
<p>FYI: <span class="user-mention" data-user-id="214522">@Leo Le Bouter</span>  I created <a href="https://github.com/rust-analyzer/rust-analyzer/issues/2904" target="_blank" title="https://github.com/rust-analyzer/rust-analyzer/issues/2904">an issue</a>, added it to my bookmarks. I hope my proposal is reasonable</p>



<a name="186592394"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186592394" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186592394">(Jan 25 2020 at 23:03)</a>:</h4>
<blockquote>
<p><span class="user-mention silent" data-user-id="214522">Leo Le Bouter</span> I can assure you it won't compromise your machine any more than a <code>cargo check</code> will.<br>
If your threat model involves RCE from reviewing untrusted crates you should probably be running your entire setup isolated from anything important, preferably on an airgapped machine, but at least in a VM</p>
</blockquote>
<p>I'm as worried about the <code>cargo check</code> but yeah, in the mean time, that's what I do. I would prefer if Rust could make that a little better :-) Isn't it designed for security after all? The <a class="stream" data-stream-id="146229" href="/#narrow/stream/146229-wg-secure-code">#wg-secure-code</a> is working on it as well.</p>



<a name="186592444"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186592444" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186592444">(Jan 25 2020 at 23:04)</a>:</h4>
<p><span class="user-mention" data-user-id="258149">@std::Veetaha</span> Could not replicate the issue either. It seems to be caused by a set of things rather than a single thing, which makes it hard to reproduce. The error showed up in my logs and that's it.</p>



<a name="186592456"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186592456" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186592456">(Jan 25 2020 at 23:05)</a>:</h4>
<p>And thanks!</p>



<a name="186601596"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186601596" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186601596">(Jan 26 2020 at 04:00)</a>:</h4>
<p>I got the error again, still don't know exactly what caused it, can't reproduce, rewriting my code doesnt seem to work.</p>
<div class="codehilite"><pre><span></span>error: expected one of `)`, `,`, `::`, or `|`, found `.`
  --&gt; &lt;stdin&gt;:85:54
   |
85 |             e @ Err(std::io::ErrorKind::AlreadyExists.into()) =&gt; e.context(CreateSsbDir {
   |                                                      ^ expected one of `)`, `,`, `::`, or `|` here

error: expected one of `)`, `,`, `::`, or `|`, found `.`
  --&gt; &lt;stdin&gt;:85:54
   |
85 |             e @ Err(std::io::ErrorKind::AlreadyExists.into()) =&gt; e.context(CreateSsbDir {
   |                                                      ^ expected one of `)`, `,`, `::`, or `|` here

error: expected one of `)`, `,`, `::`, or `|`, found `.`
  --&gt; &lt;stdin&gt;:85:54
   |
85 |             e @ Err(std::io::ErrorKind::AlreadyExists.into()) =&gt; e.context(CreateSsbDir {
   |                                                      ^ expected one of `)`, `,`, `::`, or `|` here

free(): invalid next size (fast)
</pre></div>



<a name="186601608"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186601608" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186601608">(Jan 26 2020 at 04:01)</a>:</h4>
<p>I was being a little spammy on Ctrl-Shift-I (Format) -- if that's any relevant.</p>



<a name="186601724"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186601724" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186601724">(Jan 26 2020 at 04:05)</a>:</h4>
<p>Hmm, I think I can reproduce now. It has to do with where clauses while they're being written.</p>



<a name="186601726"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186601726" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186601726">(Jan 26 2020 at 04:05)</a>:</h4>
<div class="codehilite"><pre><span></span>thread &#39;&lt;unnamed&gt;&#39; panicked at &#39;byte index 3 is not a char boundary; it is inside &#39;\u{3}&#39; (bytes 2..3) of `�u��   0: backtrace::backtrace::libunwind::trace
             at /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.40/src/backtrace/libunwind.rs:88
   1: backtrace::backtrace::trace_unsynchronized
             at /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.40/src/backtrace/mod.rs:66
   2: std::sys_common::backtrace::_print_fmt
             at src/libstd/sys_common/backtrace.rs:77
   3: &lt;std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display&gt;::fmt
             at src/libstd/sys_common/backtrace.rs:61
   4: core::fmt::write
             at src/libcore/fmt/mod.rs:1028
   5: std::io::Write::write_fmt
             at src/libstd/io/mod.rs:1412
   6: std::sys_common::backtrace::_print
             at src/libstd/sys_common/backtrace.rs:65
   7: std::sys_common::backtrace::print
             at src/libstd/sys_common/backtrace.rs:50
   8: std::panicking::default_hook::{{closure}}
             at src/libstd/panicking.rs:188
   9: std::panicking::default_hook
             at src/libstd/panicking.rs:205
  10: std::panicking::rust_panic_with_hook
             at src/libstd/panicking.rs:464
  11: std::panicking::continue_panic_fmt
             at src/libstd/panicking.rs:373
  12: rust_begin_unwind
             at src/libstd/panicking.rs:302
  13: core::panicking::panic_fmt
             at src/libcore/panicking.rs:139
  14: core::str::slice_error_fail
             at src/libcore/str/mod.rs:0
  15: core::str::traits::&lt;impl core::slice::SliceIndex&lt;str&gt; for core::ops::range::Range&lt;usize&gt;&gt;::index::{{closure}}
  16: serde_json::ser::format_escaped_str
  17: serde::ser::SerializeMap::serialize_entry
  18: lsp_server::msg::Message::write
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
free(): invalid next size (fast)
</pre></div>



<a name="186601727"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186601727" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186601727">(Jan 26 2020 at 04:05)</a>:</h4>
<p>Got this as well, now.</p>



<a name="186601904"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186601904" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186601904">(Jan 26 2020 at 04:11)</a>:</h4>
<p>Also</p>
<div class="codehilite"><pre><span></span>corrupted double-linked list
</pre></div>



<a name="186601908"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186601908" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186601908">(Jan 26 2020 at 04:11)</a>:</h4>
<p>heap overflow?</p>



<a name="186601950"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186601950" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186601950">(Jan 26 2020 at 04:13)</a>:</h4>
<p>I think I can reproduce almost reliably now. I'll make a video</p>



<a name="186601957"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186601957" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186601957">(Jan 26 2020 at 04:13)</a>:</h4>
<p>It only happens in interactivity</p>



<a name="186602327"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186602327" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186602327">(Jan 26 2020 at 04:25)</a>:</h4>
<p>And when making the video it wont reproduce anymore... urgggh</p>



<a name="186609315"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186609315" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186609315">(Jan 26 2020 at 07:14)</a>:</h4>
<p>As a hint, it seems to always happen when I write before the first <code>{</code> just after the head of a struct definition.</p>



<a name="186609324"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186609324" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186609324">(Jan 26 2020 at 07:15)</a>:</h4>
<p>Such as, adding spaces or a newline</p>



<a name="186613364"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186613364" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186613364">(Jan 26 2020 at 09:25)</a>:</h4>
<p><code>malloc_consolidate(): invalid chunk size</code></p>



<a name="186613544"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186613544" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186613544">(Jan 26 2020 at 09:30)</a>:</h4>
<p>It seems that the overflow is going over the source code buffer:</p>
<div class="codehilite"><pre><span></span>thread &#39;&lt;unnamed&gt;&#39; panicked at &#39;byte index 1 is not a char boundary; it is inside &#39;\u{10}&#39; (bytes 0..1) of `��\�stack backtrace:
   0: backtrace::backtrace::libunwind::trace
             at /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.40/src/backtrace/libunwind.rs:88
   1: backtrace::backtrace::trace_unsynchronized
             at /cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.40/src/backtrace/mod.rs:66
   2: std::sys_common::backtrace::_print_fmt
             at src/libstd/sys_common/backtrace.rs:77
   3: &lt;std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display&gt;::fmt
             at src/libstd/sys_common/backtrace.rs:61
   4: core::fmt::write
             at src/libcore/fmt/mod.rs:1028
   5: std::io::Write::write_fmt
             at src/libstd/io/mod.rs:1412
   6: std::sys_common::backtrace::_print
             at src/libstd/sys_common/backtrace.rs:65
   7: std::sys_common::backtrace::print
             at src/libstd/sys_common/backtrace.rs:50
   8: std::panicking::default_hook::{{closure}}
             at src/libstd/panicking.rs:188
   9: std::panicking::default_hook
             at src/libstd/panicking.rs:205
  10: std::panicking::rust_panic_with_hook
             at src/libstd/panicking.rs:464
  11: std::panicking::continue_panic_fmt
             at src/libstd/panicking.rs:373
  12: rust_begin_unwind
             at src/libstd/panicking.rs:302
  13: core::panicking::panic_fmt
             at src/libcore/panicking.rs:139
  14: core::str::slice_error_fail
             at src/libcore/str/mod.rs:0
  15: core::str::traits::&lt;impl core::slice::SliceIndex&lt;str&gt; for core::ops::range::Range&lt;usize&gt;&gt;::index::{{closure}}
  16: serde_json::ser::format_escaped_str
  17: serde::ser::SerializeMap::serialize_entry
  18: lsp_server::msg::Message::write
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
free(): invalid next size (fast)
</pre></div>



<a name="186616497"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186616497" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186616497">(Jan 26 2020 at 10:57)</a>:</h4>
<p>I got a debug trace:</p>
<div class="codehilite"><pre><span></span>#0  0x00007fff8cebfcf4 in _int_free () from /lib64/libc.so.6
#1  0x000000011461a0b8 in std::sys::unix::alloc::&lt;impl core::alloc::GlobalAlloc for std::alloc::System&gt;::dealloc () at src/libstd/sys/unix/alloc.rs:42
#2  __rdl_dealloc () at src/libstd/alloc.rs:246
#3  0x00000001140023a4 in core::ptr::real_drop_in_place ()
#4  0x0000000113f11d14 in core::ptr::real_drop_in_place ()
#5  0x0000000113f16b3c in core::ptr::real_drop_in_place ()
#6  0x0000000113e64660 in alloc::sync::Arc&lt;T&gt;::drop_slow ()
#7  0x00000001142940e0 in salsa::derived::slot::Slot&lt;DB,Q,MP&gt;::read_upgrade ()
#8  0x00000001142e4188 in salsa::derived::slot::Slot&lt;DB,Q,MP&gt;::read ()
#9  0x0000000113fe150c in &lt;salsa::derived::DerivedStorage&lt;DB,Q,MP&gt; as salsa::plumbing::QueryStorageOps&lt;DB,Q&gt;&gt;::try_fetch ()
#10 0x0000000113e1bc98 in salsa::QueryTable&lt;DB,Q&gt;::get ()
#11 0x00000001140eb9f4 in ra_hir_ty::traits::trait_solve_query ()
#12 0x0000000114055de8 in salsa::runtime::Runtime&lt;DB&gt;::execute_query_implementation ()
#13 0x00000001142c4ae0 in salsa::derived::slot::Slot&lt;DB,Q,MP&gt;::read_upgrade ()
#14 0x000000011422aacc in &lt;salsa::derived::slot::Slot&lt;DB,Q,MP&gt; as salsa::dependency::DatabaseSlot&lt;DB&gt;&gt;::maybe_changed_since ()
#15 0x000000011428a41c in salsa::derived::slot::Slot&lt;DB,Q,MP&gt;::read_upgrade ()
#16 0x00000001142e5408 in salsa::derived::slot::Slot&lt;DB,Q,MP&gt;::read ()
#17 0x0000000113fe7690 in &lt;salsa::derived::DerivedStorage&lt;DB,Q,MP&gt; as salsa::plumbing::QueryStorageOps&lt;DB,Q&gt;&gt;::try_fetch ()
#18 0x0000000113f84fd8 in ra_hir_ty::db::infer ()
#19 0x0000000113e166d0 in ra_hir::code_model::Function::diagnostics ()
#20 0x0000000113e153a0 in ra_hir::code_model::Module::diagnostics ()
#21 0x0000000114060e00 in ra_ide::diagnostics::diagnostics ()
#22 0x000000011408327c in std::panicking::try::do_call ()
#23 0x00000001146244f4 in __rust_maybe_catch_panic () at src/libpanic_unwind/lib.rs:78
#24 0x000000011417979c in ra_db::CheckCanceled::catch_canceled ()
#25 0x0000000113fb4bd0 in ra_ide::Analysis::diagnostics ()
#26 0x0000000113a8779c in ra_lsp_server::main_loop::handlers::publish_diagnostics ()
#27 0x00000001139f1330 in &lt;F as threadpool::FnBox&gt;::call_box ()
#28 0x0000000113c6df1c in std::sys_common::backtrace::__rust_begin_short_backtrace ()
#29 0x00000001146244f4 in __rust_maybe_catch_panic () at src/libpanic_unwind/lib.rs:78
#30 0x0000000113c6e8fc in core::ops::function::FnOnce::call_once{{vtable-shim}} ()
#31 0x0000000114607538 in &lt;alloc::boxed::Box&lt;F&gt; as core::ops::function::FnOnce&lt;A&gt;&gt;::call_once () at /rustc/73528e339aae0f17a15ffa49a8ac608f50c6cf14/src/liballoc/boxed.rs:942
#32 0x0000000114623490 in &lt;alloc::boxed::Box&lt;F&gt; as core::ops::function::FnOnce&lt;A&gt;&gt;::call_once () at /rustc/73528e339aae0f17a15ffa49a8ac608f50c6cf14/src/liballoc/boxed.rs:942
#33 std::sys_common::thread::start_thread () at src/libstd/sys_common/thread.rs:13
#34 std::sys::unix::thread::Thread::new::thread_start () at src/libstd/sys/unix/thread.rs:79
#35 0x00007fff8d079a88 in start_thread () from /lib64/libpthread.so.0
#36 0x00007fff8cf53998 in clone () from /lib64/libc.so.6
</pre></div>



<a name="186616739"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186616739" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> std::Veetaha <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186616739">(Jan 26 2020 at 11:04)</a>:</h4>
<p><span class="user-mention" data-user-id="214522">@Leo Le Bouter</span> big thank you for the input, could you please describe the steps you've taken to reproduce this <strong>AND</strong> get the backtrace (the backtrace part is one of the most interesting to me)?</p>



<a name="186616749"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186616749" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186616749">(Jan 26 2020 at 11:04)</a>:</h4>
<p><span class="user-mention" data-user-id="258149">@std::Veetaha</span> Can't say, really. It's not exact what causes it.</p>



<a name="186616760"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186616760" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186616760">(Jan 26 2020 at 11:05)</a>:</h4>
<p>I can't say more than:</p>
<blockquote>
<p>As a hint, it seems to always happen when I write before the first <code>{</code> just after the head of a struct definition.</p>
</blockquote>



<a name="186616768"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186616768" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186616768">(Jan 26 2020 at 11:05)</a>:</h4>
<p>For the backtrace, I attached gdb?</p>



<a name="186616774"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186616774" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186616774">(Jan 26 2020 at 11:06)</a>:</h4>
<p>And waited until it happened again</p>



<a name="186616814"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186616814" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186616814">(Jan 26 2020 at 11:06)</a>:</h4>
<p>I'm recompiling ra in debug mode as we speaj</p>



<a name="186616815"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186616815" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186616815">(Jan 26 2020 at 11:06)</a>:</h4>
<p>speak *</p>



<a name="186616893"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186616893" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> std::Veetaha <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186616893">(Jan 26 2020 at 11:09)</a>:</h4>
<p><span class="user-mention" data-user-id="214522">@Leo Le Bouter</span> If you project is open-source, a link to the place where you put <code>{</code> after the head of a struct (whatever this means) would be helpful. Otherwise you could give us an excerpt of the code where the crash is triggered</p>



<a name="186616942"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186616942" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186616942">(Jan 26 2020 at 11:10)</a>:</h4>
<p><span class="user-mention" data-user-id="258149">@std::Veetaha</span> It does not seem specific to any particular source code, but <a href="https://github.com/leo-lb/ssb-server-rs" target="_blank" title="https://github.com/leo-lb/ssb-server-rs">https://github.com/leo-lb/ssb-server-rs</a></p>



<a name="186616972"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186616972" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> std::Veetaha <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186616972">(Jan 26 2020 at 11:11)</a>:</h4>
<p>I know, yes, it's just to let us reproduce it locally on our machines</p>



<a name="186617024"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186617024" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186617024">(Jan 26 2020 at 11:12)</a>:</h4>
<p>I don't think you'll be able to reproduce. One example place would be: <a href="https://github.com/leo-lb/ssb-packetstream/blob/e6ad8807502a6c37fbc907a9f77eb7eeb06fa3b9/src/stream.rs#L95" target="_blank" title="https://github.com/leo-lb/ssb-packetstream/blob/e6ad8807502a6c37fbc907a9f77eb7eeb06fa3b9/src/stream.rs#L95">https://github.com/leo-lb/ssb-packetstream/blob/e6ad8807502a6c37fbc907a9f77eb7eeb06fa3b9/src/stream.rs#L95</a></p>



<a name="186617052"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186617052" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> std::Veetaha <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186617052">(Jan 26 2020 at 11:13)</a>:</h4>
<p>We would have to do it or the bug won't be fixed, nevertheless ;) Thanks for this input again!</p>



<a name="186617132"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186617132" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186617132">(Jan 26 2020 at 11:16)</a>:</h4>
<p><span class="user-mention" data-user-id="258149">@std::Veetaha</span> In that case, I don't think it will ever get fixed :-/</p>



<a name="186617485"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186617485" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186617485">(Jan 26 2020 at 11:26)</a>:</h4>
<p>Seems like running ra in debug mode is just not practical at all. So slow!</p>



<a name="186617507"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186617507" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186617507">(Jan 26 2020 at 11:27)</a>:</h4>
<p><span class="user-mention" data-user-id="258149">@std::Veetaha</span> If you want to reproduce from that code, try removing the where clause, putting it back character by character, CTRL-S + CTRL-SHIFT-I, and again and again, at some point, the heap will get corrupt</p>



<a name="186617550"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186617550" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186617550">(Jan 26 2020 at 11:28)</a>:</h4>
<p>Try putting back <code>where:</code> just after the struct and removing, pressing CTRL-SHIFT-I / CTRL-S all while writing it multiple times</p>



<a name="186617551"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186617551" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> std::Veetaha <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186617551">(Jan 26 2020 at 11:28)</a>:</h4>
<p><span class="user-mention" data-user-id="214522">@Leo Le Bouter</span>  if you have time, may I ask you to formalize what you've done today to reproduce this and put it into an issue on <code>rust-analyzer</code> repo? I could take all that traces you've provided and move them to an issue myself, but I don't have the full context of which concrete commands you used and what steps you take, we need this to be in the form of an algorithm e.g.</p>
<ol>
<li>I cloned the fresh repo of analyzer (commit hash)</li>
<li>I've built it with <code>&lt;command here&gt;</code></li>
<li>blah blah</li>
</ol>



<a name="186617552"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186617552" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186617552">(Jan 26 2020 at 11:28)</a>:</h4>
<p><code>where:</code> is invalid syntax but I noticed that's how it happened most</p>



<a name="186617564"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186617564" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Leo Le Bouter <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186617564">(Jan 26 2020 at 11:30)</a>:</h4>
<p>I don't have any exact path to reproduction, else I would've done that already, once I have one, I'll be sure to fill an issue</p>



<a name="186617744"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/185405-t-compiler/rust-analyzer/topic/heap%20corruption/double%20free/invalid%20pointer%20free%20bug/near/186617744" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> std::Veetaha <a href="https://rust-lang.github.io/zulip_archive/stream/185405-t-compiler/rust-analyzer/topic/heap.20corruption.2Fdouble.20free.2Finvalid.20pointer.20free.20bug.html#186617744">(Jan 26 2020 at 11:34)</a>:</h4>
<p>Yes, floating bugs are hard, just mention that the steps you provided won't necessarily lead to the crash. They would serve just as a context where this issue is more probable to happen</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>